Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
To move a Drupal site on Ubuntu from HTTP to HTTPS, issue a Let’s Encrypt certificate with Certbot, configure Apache to serve the site on port 443, redirect port 80 to one canonical HTTPS hostname, and check Drupal’s host and proxy settings. Then test the site and Certbot’s renewal process. This guide assumes Drupal already works over HTTP and Apache handles TLS directly; proxy and CDN deployments need additional configuration.
Examples use example.com, www.example.com, and the Composer-based Drupal web root /var/www/example.com/web. Replace them consistently with your domain and document root. Omit www if you do not use it.
Before you begin
- DNS: The domain’s A record must point to this server. If there is an AAAA record, it must point to a working IPv6 endpoint on the same site; a stale IPv6 record can break validation or access even when IPv4 works.
- Ports and access: You need SSH access and a sudo-capable account. Allow inbound TCP ports 80 and 443 through the host firewall and any cloud firewall or router. HTTP-01 certificate validation normally needs port 80 reachable.
- Apache: Know which virtual host serves Drupal and where its document root is. Ubuntu stores site configurations in
/etc/apache2/sites-available/;apache2ctl -Sshows which virtual hosts Apache actually selects. See the Ubuntu Apache virtual-host guide. - Backups: Back up the database, uploaded files, Drupal settings, and Apache configuration before changing anything. Use your normal backup tooling; database names, credentials, and deployment layouts differ.
- Hostname policy: Decide whether users should end up at the bare domain or at
www. The certificate, Apache aliases, redirect, and Drupal trusted-host list must agree.
Drupal 8 and later are covered below. Composer-based Drupal commonly has a web subdirectory as its document root; older or non-Composer installations may use another path. Drupal 7 has different configuration conventions, so do not apply the Drupal 8+ settings examples to it without checking version-specific guidance.
If a CDN, load balancer, or reverse proxy terminates public HTTPS before traffic reaches Apache, skip the direct-TLS assumptions in the certificate and redirect steps. See the proxy section.
#1 Best Overall
- 【Wide Application】 XOOL M6 Rack Mount Screw Kit is great for mounting your rack server cabinets, server shelves, A/V device enclosures, and more. These M6 cage nuts and screws are universally compatible with all square-hole racks and cabinets. Easily mount your equipment using this convenient kit, which comes with everything you'll need to get the job done. These self-locking cable ties are perfect for computer, appliance and electronic cord organization, wire management and storage.
- 【Superb Quality】 The cage nuts and screws is made of high quality Carbon Steel. The Carbon Steel material features strength and offers good corrosion resistance in bad environment like high temperature, cold weather, and high humidity areas. They have superior rust resistance and the excellent of oxidation resistance, which can ensure long time using and prolong screws and nuts lifespan. Wear resistant feature make the cage nuts and screws more durable and solid.
- 【Standard Metric】 Our M6 screws and cage nuts accord with standardized metric system. And the average error is less than 0.01mm. The screw thread is very sharp, clean and accurate without burr. The compact and force uniform screw thread is not easy to out of shape and slid in the process of rolling and installation. The deep and clear flat cross head can make your working more easily and improve your work efficiency.
- 【Safety and Eco-Friendly】 XOOL M6 screws and cage nuts use high quality Carbon Steel raw material, which is environmental protection and non-poisonous. In the process of using, there are no toxic substances releasing, which will ensure your safety. After heat treating, carbon steel has good mechanical properties of ductility, hardness, yield strength, or impact resistance.
- 【Thoughtful Design】 We add self-locking Nylon cable ties on our package. The CABLE TIES is good for home, office, garage, workshop and more. And the screw is very easy to insert with hand.
1. Check DNS, Apache, and the current site
From a machine with DNS tools, check both address record types:
dig +short example.com A
dig +short example.com AAAAAn empty AAAA answer is fine if you do not publish IPv6. If one exists, verify that IPv6 reaches this server and that Apache serves the intended site over it.
On the server, inspect Apache’s virtual hosts, relevant modules, configuration syntax, and current HTTP response:
Recommended Free Tools
sudo apache2ctl -S
sudo apache2ctl -M | grep -E 'rewrite|ssl|headers'
sudo apache2ctl configtest
curl -I http://example.comconfigtest should report Syntax OK. Confirm the HTTP request reaches the intended Drupal installation, not the default Apache page or another site. Drupal’s Apache requirements include Apache 2.4.7 or later, mod_rewrite, and permission for Drupal’s .htaccess file through AllowOverride All; see the Drupal web-server requirements.
2. Back up configuration and Drupal data
Save a copy of Apache’s configuration before editing it:
sudo cp -a /etc/apache2 /etc/apache2.backup.$(date +%F)If a Let’s Encrypt configuration already exists, preserve it too:
sudo cp -a /etc/letsencrypt /etc/letsencrypt.backup.$(date +%F) 2>/dev/null || trueBack up Drupal’s files and database with the tools appropriate to your installation. For example, a MySQL or MariaDB dump might use mysqldump -u USER -p DATABASE > backup.sql, but the database name, account, authentication method, and use of containers vary. Confirm that your backup can be restored rather than relying on an unverified file.
3. Prepare the Apache virtual host for Drupal
A typical port-80 virtual host before certificate installation might look like this. Adjust the file name, domain, and document root for your site:
Rank #2
![M6 Cage Nuts, Screws and Washers [Size: M6 x 16mm 50 Pack] Rack Mount Screws Hardware for use with Network and Server Rack Accessories, Routers, Cabinets and Enclosures.](https://m.media-amazon.com/images/I/51yizSYkrhL._SL160_.jpg)
- Pro Grade – Here is our new Black M6 Rack Screws and Cage Nuts Set [25 x Server Rack Screws, 25 x Cage Rack Nuts, 25 x Washers] used for mounting server racks, enclosures, cabinets, and more.
- Strong & Durable – Our Rack Cage Nuts & Relay Rack Screws for server rack have a high-grade carbon steel construction to prevent stripping. The M6 Cage Nuts and Bolts have also been coated in zinc chromate plating for resistance from corrosion.
- Wide application – Our rack screws & nuts are universally compatible with all square hole racks & cabinets. This makes the rack cage nuts and screws suitable for mounting all server rack hardware, including rack server cabinets, server shelves, A/V device enclosures, and other server mounting procedures.
- Easy to install – Our server rack screws and clip nuts have a Phillip’s truss-head with self-guiding pilot points to allow you to install in no time. The rackmount screws and nuts thread are extra sharp, clean & accurate, offering a smooth & satisfying installation process.
- Essential Bundle – Our Cage nuts & screws m6 set includes all the essential parts for mounting your server equipment. Pack not only includes screws & cage nuts; we have also thrown in additional heavy-duty washers to reduce any marks or scratches when installed. We truly believe our server rack nuts and bolts set is the best in the marketplace and we stand by that. If our cage nut set starts driving you nuts, we’ll FULLY REFUND YOU. So, click “Add to Cart” now and buy with confidence.
<VirtualHost *:80>
ServerName example.com
ServerAlias www.example.com
DocumentRoot /var/www/example.com/web
<Directory /var/www/example.com/web>
AllowOverride All
Require all granted
Options -MultiViews
</Directory>
ErrorLog ${APACHE_LOG_DIR}/example-error.log
CustomLog ${APACHE_LOG_DIR}/example-access.log combined
</VirtualHost>On Ubuntu, enable the site and the modules commonly needed for Drupal and HTTPS, if they are not already enabled:
sudo a2ensite example.conf
sudo a2enmod rewrite ssl headers
sudo apache2ctl configtest
sudo systemctl reload apache2Replace example.conf with the actual site configuration file. The headers module is useful if you later add security headers; it does not mean you should enable HSTS immediately. Ubuntu documents module management and SSL setup in its Apache modules guide.
AllowOverride All in the HTTPS virtual host matters too, not just in the current HTTP one: Drupal commonly relies on .htaccess for clean URLs. Keep the HTTPS document root pointed at the same intended Drupal web root.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →4. Install Certbot
Certbot currently recommends the snap installation for most users. Install snap support if needed, then install Certbot:
sudo apt update
sudo apt install snapd
sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/local/bin/certbotBefore switching installation methods, check whether a distribution package or another Certbot installation is already present:
which certbot
certbot --versionDo not leave conflicting Certbot installations that could cause the wrong executable or renewal mechanism to be used. Distribution packages may also be appropriate for some Ubuntu releases, but their versions and plugin availability vary. See Certbot’s Apache installation instructions for the current recommended route.
5. Issue the certificate and enable HTTPS
For a site whose TLS is handled directly by Apache, run this with every hostname visitors should be able to reach:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →sudo certbot --apache -d example.com -d www.example.comThe Apache installer obtains the certificate and can update Apache’s configuration. It will prompt for an email address, terms of service, and whether to share the address with the EFF. If Apache has multiple matching sites, check the names Certbot identifies. Choose the HTTP-to-HTTPS redirect option once you are ready to serve the HTTPS site.
Rank #3
- COMPLETE M6 RACK SCREWS KIT：Includes 45 square rack cage nuts, 45 rack mounting screws and 45 black washers stored in a plastic storage box for easy organization and quick access
- DURABLE CARBON STEEL WITH BLACK NICKEL PLATING：Rack screws and cage nuts are built of carbon steel with black nickel coating to deliver excellent oxidation, rust, corrosion and wear resistance for long-term use in high and low temperature environments
- PRECISE SHARP THREADS FOR SAFE INSTALLATION：Server rack mounting hardware features deep sharp threads and smooth burr-free surface for secure, safe installation of rack and cabinet equipment
- UNIVERSAL COMPATIBILITY FOR SQUARE-HOLE RACKS：M6 x 16mm rack screws fit standard 10mm square-hole racks and cabinets; ideal for mounting servers, switches, routers and A/V equipment in data centers and workspaces
- TIGHT TOLERANCE MANUFACTURING：Conforms to metric standard with less than 0.01mm average error; compact thread structure ensures tight fit, uniform force distribution and resistance against deformation and slipping
Remove -d www.example.com if you do not serve that name. A certificate only covers the hostnames requested; a name omitted from the certificate must not remain a working public alias unless it redirects through a separately valid certificate.
If you want Certbot to issue the certificate but prefer to make all Apache changes yourself, use:
sudo certbot certonly --apache -d example.com -d www.example.comcertonly obtains the certificate but does not install Apache configuration changes for you. HTTP-01 validation generally requires DNS to point to this server and port 80 to be reachable. Wildcard certificates require DNS-01 validation, which involves DNS-provider credentials or manual DNS changes; consult Certbot’s instructions for that workflow.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11After issuance, inspect what Certbot created:
sudo certbot certificates
sudo apache2ctl -S
sudo grep -R "SSLCertificate" /etc/apache2/sites-enabled /etc/apache2/sites-availableDo not assume the correct virtual host was edited merely because issuance succeeded. Confirm that the intended hostname reaches the intended Drupal root on port 443.
6. Manual Apache configuration (if using certonly)
Use separate virtual hosts: one on port 80 that redirects to the chosen canonical HTTPS name, and one on port 443 that serves Drupal. For example, to use the bare domain as canonical:
<VirtualHost *:80>
ServerName example.com
ServerAlias www.example.com
Redirect permanent / https://example.com/
</VirtualHost>
<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerName example.com
ServerAlias www.example.com
DocumentRoot /var/www/example.com/web
<Directory /var/www/example.com/web>
AllowOverride All
Require all granted
Options -MultiViews
</Directory>
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
ErrorLog ${APACHE_LOG_DIR}/example-ssl-error.log
CustomLog ${APACHE_LOG_DIR}/example-ssl-access.log combined
</VirtualHost>
</IfModule>Redirect permanent preserves the requested path and query string in the usual Apache configuration, so a request for an HTTP page can reach the corresponding HTTPS page. If using www as canonical instead, change the destination and ensure the certificate covers both names. Avoid conflicting redirects in Apache, Drupal, a CDN, or .htaccess that send each hostname back and forth.
Enable the SSL site file you created, then test before reloading:
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo a2ensite example-le-ssl.conf
sudo apache2ctl configtest
sudo systemctl reload apache2Use the actual filename. Never reload after a failed syntax check; diagnose the reported error first.
Rank #4
- Durable Carbon Steel: Rack mount screws and cage nuts are made of high-quality carbon steel with a black finish for high strength and dependable durability.
- Easy Installation: Clear metric threads and uniform pitch for better grip. Nylon washers help secure screws and protect equipment surfaces.
- Organized Storage: All parts are packed in a portable storage box for easy organization and access.
- Wide Compatibility: Fits most square-hole racks and cabinets—ideal for server racks, network cabinets, equipment enclosures, and A/V gear.
- 20-Set Kit: Includes 20 mounting screws with nylon washers (M6 x 20 mm) and 20 square cage nuts—40 pieces in total—meeting daily install and replacement needs.
7. Configure Drupal’s trusted hosts and clear caches
For Drupal 8 and later, edit the active site’s settings.php, commonly /var/www/example.com/web/sites/default/settings.php, and ensure the trusted host patterns include only the real names you serve:
$settings['trusted_host_patterns'] = [
'^example.com$',
'^www.example.com$',
];If only the bare domain is legitimate, include only that pattern. These are regular expressions without delimiters. Drupal returns HTTP 400 when the request host does not match the configured patterns; see Drupal’s trusted-host settings documentation. Do not use a catch-all such as .* just to suppress an error.
Changing from HTTP to HTTPS alone does not normally require a database migration or a universal $base_url setting in modern Drupal. Avoid adding legacy advice such as $base_url = 'https://example.com'; as a blanket Drupal 8–11 fix. Check application-specific configuration if generated links still use HTTP.
Clear caches using the Drush version and project setup you actually have. In a Composer project with Drush installed locally:
cd /var/www/example.com
vendor/bin/drush crIf Drush is installed globally, drush cr may work instead. Do not assume either command exists or that the project’s vendor directory is on your shell’s PATH.
If HTTPS terminates at a proxy or CDN
This guide’s Certbot and Apache vhost steps assume the public TLS connection ends at Apache. If a proxy, CDN, or load balancer handles public HTTPS, the public certificate may belong at that edge, at the origin, or both; Certbot’s Apache plugin may not be the right tool for the public certificate.
In that topology, Drupal may receive an HTTP connection from the proxy even when the visitor used HTTPS. Configure the proxy to send a trustworthy forwarded-protocol header, then configure Drupal’s $settings['reverse_proxy'] and $settings['reverse_proxy_addresses'] to match the actual trusted proxy addresses. Do not trust forwarded headers from arbitrary clients. Implement redirects at the appropriate layer and verify the proxy’s origin TLS mode; otherwise Apache and the proxy can cause an HTTPS redirect loop. Avoid applying direct-to-Apache assumptions without checking the proxy’s own documentation and Drupal’s reverse-proxy configuration for your version.
8. Fix mixed content and test Drupal functionality
A valid certificate does not automatically repair URLs embedded in content, themes, modules, or integrations. Open the site in a browser and check developer tools for mixed-content warnings. Look for hard-coded http:// image, stylesheet, script, embed, and absolute-link URLs in content, WYSIWYG markup, custom code, theme settings, and external services. Fix stored or generated URLs at their source; a blanket “upgrade insecure requests” policy is not a substitute, and it cannot make an incompatible third-party resource work.
Best Value
- Accurate & Durable Design：Our M6 screws and cage nuts are manufactured to strict metric standards with an average tolerance of less than 0.01 mm for accurate fit and reliable performance. The threads are sharp, clean, and burr-free, ensuring smooth installation. The compact, evenly distributed thread design resists deformation and slipping during fastening. A deep, well-defined Phillips head allows for easier operation and improved work efficiency.
- Heavy-Duty & Long-Lasting：Constructed from premium carbon steel with a protective black nickel coating to resist rust and oxidation. Designed to withstand high temperatures, cold weather, and other harsh conditions for reliable, long-term performance.
- Clean & Professional Look：Finished in sleek black nickel to match most rack systems, delivering a clean, organized, and professional appearance inside your cabinet.
- Wide Application：Perfect for server cabinets, rack shelves, and A/V enclosures. Compatible with all standard square-hole racks, this M6 cage nut and screw kit provides secure installation hardware along with durable self-locking cable ties for clean and organized wire management.
- 50-Pack Complete Set – Comes with 50 cage nuts, 50 mounting screws, and 50 black washers. Packaged in a sturdy small box to keep everything organized and easy to store.
Drupal’s HTTPS guidance recommends serving the whole site over HTTPS and discusses mixed content, redirects, cookies, and HSTS: Enabling HTTP Secure (HTTPS). Test the homepage and several internal clean URLs, login and password reset, administrative pages, forms, uploads, AJAX behavior, images and other assets, APIs, feeds and XML sitemaps, cron or queued jobs, outbound email links, webhooks, and integrations. Drupal’s HTTPS handling supports secure session cookies over HTTPS, but still verify login and session behavior on your installation.
9. Verify redirects, certificate, and renewal
Check the canonical HTTPS response and both HTTP names, if both are used:
curl -I https://example.com
curl -I http://example.com
curl -I http://www.example.com
curl -IL http://example.comThe HTTP requests should end in a permanent redirect to your chosen HTTPS hostname, preserving the requested path. For example, a bare-domain policy should result in a Location: https://example.com/... header. Follow the full chain with -IL to catch loops or an unexpected hostname hop.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Inspect the certificate presented for the hostname:
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null
| openssl x509 -noout -issuer -subject -datesThen test the renewal workflow, not just the initial issuance:
sudo certbot renew --dry-run
sudo systemctl list-timers | grep -i certbotDepending on the snap setup, the timer may be named snap.certbot.renew.timer; check it with sudo systemctl status snap.certbot.renew.timer. A successful dry run checks the renewal path but does not validate every Drupal URL, redirect, or proxy route. Ubuntu’s guidance covers the renewal dry run and timer: Obtain TLS certificates.
10. Troubleshoot by symptom
| Symptom | What to check | Next step |
|---|---|---|
| Certbot cannot validate the domain | DNS A and AAAA records, public reachability of port 80, firewall rules, the selected Apache vhost, and any CDN or rewrite behavior affecting /.well-known/acme-challenge/. |
Run dig +short example.com A, dig +short example.com AAAA, sudo ss -ltnp | grep -E ':80|:443', and sudo apache2ctl -S. Fix DNS or reachability. If port 80 cannot be used, use DNS-01; wildcard certificates need DNS-01. |
| Apache fails to reload | Syntax errors, duplicate or malformed vhosts, missing modules, typos, or certificate paths that do not exist. | Run sudo apache2ctl configtest and sudo journalctl -u apache2 -n 100 --no-pager. Do not reload until the configuration test succeeds. |
| Apache default page appears over HTTPS | Whether the SSL site is enabled, the matching ServerName/ServerAlias, and the HTTPS document root. |
Inspect sudo apache2ctl -S and ls -l /etc/apache2/sites-enabled/; ensure the intended Drupal vhost is selected and configured. |
| Homepage works but internal paths return 404 | mod_rewrite and AllowOverride All in the port-443 directory block. |
Enable rewrite with sudo a2enmod rewrite, confirm the HTTPS vhost permits Drupal’s .htaccess, test syntax, and reload. Drupal specifically identifies missing HTTPS-vhost override permissions as a clean-URL failure mode. |
| Redirect loop | Conflicting redirects, a CDN SSL mode, or Drupal unaware of the original HTTPS scheme behind a proxy. | Run curl -IL http://example.com and curl -IL https://example.com. Follow each Location header to identify which layer is redirecting. Align canonical-host policy and configure trusted proxy headers if applicable. |
| Drupal returns HTTP 400 | The request hostname against trusted_host_patterns. |
Add only the legitimate hostname pattern(s) to the active settings.php, then clear caches if needed. |
| Mixed-content warnings or missing assets | Hard-coded HTTP links in content, CSS, JavaScript, theme/module configuration, or third-party embeds. | Use browser developer tools to identify the exact resource and fix its stored or generated URL. Confirm the third-party resource supports HTTPS. |
| Renewal dry run fails | Current DNS and port-80 access for HTTP-01, the selected authenticator, and conflicting Certbot installations. | Read Certbot’s error output, verify the active executable with which certbot and certbot --version, then correct the validation or installation issue and repeat the dry run. |
For a Drupal multisite or several subdomains, treat each hostname and vhost deliberately: the certificate must cover the names users visit, each site must keep its own intended document root and redirect behavior, and each Drupal site’s trusted-host patterns must match its legitimate domains. A single-site example should not be copied unchanged into a multisite setup.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesOptional: add HSTS only after HTTPS is established
HSTS tells browsers that have received the policy to use HTTPS for a period of time. It does not replace a valid certificate, secure application code, or mixed-content cleanup. Add it only after every intended hostname works reliably over HTTPS and the redirect policy is settled. A cautious starting point is:
Header always set Strict-Transport-Security "max-age=31536000"Do not add includeSubDomains or submit the domain for preload unless every relevant subdomain is permanently HTTPS-capable and you understand the recovery implications. Browsers that have stored HSTS will refuse HTTP for the policy duration. Keep port 80 available by default for redirects and HTTP-01 renewal; closing it is a deliberate network-policy choice, not a routine migration step.
Rollback plan
If the change breaks Apache, Drupal, or a critical workflow, preserve the current failing configuration and inspect logs before reverting. For a syntax failure, restore the Apache backup or the affected vhost file, then run sudo apache2ctl configtest before reloading. If redirects alone are the issue, remove or correct the port-80 redirect rather than deleting the certificate. Keep the Drupal files/database backup available in case a separate application change caused the problem. After recovery, confirm both the site response and the certificate-renewal setup again.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
